The Download Counter plugin by anatolyk is vulnerable to Stored Cross‑Site Scripting through the name parameter in versions 1.3 and earlier; the flaw is a CWE‑79 input validation weakness that allows authenticated attackers with Contributor or higher privileges to inject arbitrary JavaScript that executes whenever a user visits an affected page. Such script execution can steal user sessions, modify page content, or initiate further attacks on the site.

WordPress sites using Download Counter plugin versions 1.3 and earlier are affected, regardless of the number of users or sites, as the vulnerability exists in the plugin’s core code rather than in a particular configuration.

With a CVSS score of 6.4 the vulnerability is considered moderate, and its EPSS score shows a very low but non‑zero probability of exploitation. The characteristics of the flaw—requiring authentication but permitting Contributor‑level roles—mean that it can be abused by trusted users or compromised accounts, elevating the risk to administration interfaces. The vulnerability is not currently listed in the CISA KEV catalog, but its impact on exposed user sessions and potential for defacement warrants immediate attention.